27 replies to this topic

[/Max]

Someone posted this link on the neoboards--
http://www.neopets.com/npaward.php

They said they found it in the html of one of their pet's lookups or something. When they refreshed and checked again, they said it wasn't there anymore. They blocked neomails, so I couldnt ask more.. all they said was it was [img src="http://www.neopets.c...om/npaward.php" style="display:none"] or something. Is this fishy or is just me? NP award?

[Shin]

Possible exploit? I hope.

View Source gives some weird characters. I wonder what it does.

[juju]

Interesting find. Never heard of this one before .

[Kyle]

The page source is very odd looking. Anybody know anything about it?

[Mr. Hobo]

Wierd, quoting the page source messed up my post. It's the below followed by a bunch of weird Ys but it's a 5 x 5 gif image

GIF89a

[BarCode]

When I downloaded the image, it was just a 5x5 gray square. Nothing significant I believe.

[Lemonblood]

See if theres code, it looks like this is the same way you make a random image sig thing.

EDIT: My bad, didn't read, looks like its encoded or its just the code for the image.

Edited by Revolver Ocelot, 16 August 2006 - 07:50 PM.

[Crayon]

The page source is very odd looking. Anybody know anything about it?

the investigater is here!

[Kyle]

the investigater is here!

I would only be the investigator if I had any idea about what it meant. lol

[travis]

This is sooo barking sketch...
I saw a tutorial, on CGing, and it seems to be exactly like this..

Opens a page on the forum, image redirects to CGer.

I mean, the url it goes to when you click it is

http://www.neocodex....rl=/npaward.php

[Sean]

This is sooo barking sketch...
I saw a tutorial, on CGing, and it seems to be exactly like this..

Opens a page on the forum, image redirects to CGer.

I mean, the url it goes to when you click it is

http://www.neocodex....rl=/npaward.php

I don't get it. Does that mean we all just got CGed?

[travis]

Reported, I don't like the way this topic looks.

[ATHFBlink]

Reported, I don't like the way this topic looks.

ohnoes! neopets cookiegrabbed us >_<

[Shin]

This is sooo barking sketch...
I saw a tutorial, on CGing, and it seems to be exactly like this..

Opens a page on the forum, image redirects to CGer.

I mean, the url it goes to when you click it is

http://www.neocodex....rl=/npaward.php

A lot of the links in this forum have the loc_ref.php?url= thing on the end. I don't know why, though.

Edited by shin, 16 August 2006 - 08:16 PM.

[Noitidart]

Be careful with that who knows tnt might be logging who ever goes there

[Cory]

Be careful with that who knows tnt might be logging who ever goes there

*ends vow of silence*
It was posted on the neoboards though so I don't think it would be to much of a trouble if people go their.
*returns to vow of silence*

[BarCode]

If TnT is logging it, why would it have neocodex as the host? o.O

[ShadowLink64]

loc_ref.php is a Referer spoofer I made for all the Neopets links on the site... it pretty much goes to the php script, removes the referer tag and redirects you to Neopets so they do not know the hits are coming from here (any link from here to another site carries a referer tag with it and the site you are connecting to knows where the hits are coming from).

loc_ref.php is safe as it only redirects your hits to Neopets once it removes the header.

For instance:
www.neocodex.us/forum/loc_ref.php?url=/npaward.php -> "http://www.neopets.com/npaward.php"
www.neocodex.us/forum/loc_ref.php?url=/games/diceescape.phtml -> "http://www.neopets.com/games/diceescape.phtml"

And CGing only works if the script is on the same server as the cookies. loc_ref.php can only ever have access to Neocodex cookies (the script CGing would have to be on neopets.com, and that just isn't happening unless they're retarded).

So anyways, we should have announced the change but then it would be in the news and Neopets would probably realize that we're masking hits from here to there, lol.

[Dan]

The page source is very odd looking. Anybody know anything about it?

Of course it's odd looking! It's a barking image! rofl

[/Max]

Reported, I don't like the way this topic looks.

rofl


oooh i am teh scamzorzzzz



You caught me. I hacked neopets, then put a cookie grabber in it. Since I'm in the database with everyones password showing, it's not useless to put a cookie grabber up.


/sarcasm

/yoursarcasm?


Now can we get back to figuring this out? And btw, those who have no barking idea what they're talking about (aka omg teh cookiez stealer boii), please leave us alone.

Edited by M-Xite, 17 August 2006 - 02:20 AM.

[113]

Of course it's odd looking! It's a barking image! rofl

I think the meta-data type is: image/gif

So yeah it's a gif.

Edited by 113, 17 August 2006 - 02:24 AM.

[Ender]

loc_ref.php is a Referer spoofer I made for all the Neopets links on the site... it pretty much goes to the php script, removes the referer tag and redirects you to Neopets so they do not know the hits are coming from here (any link from here to another site carries a referer tag with it and the site you are connecting to knows where the hits are coming from).

loc_ref.php is safe as it only redirects your hits to Neopets once it removes the header.

For instance:
www.neocodex.us/forum/loc_ref.php?url=/npaward.php -> "http://www.neopets.com/npaward.php"
www.neocodex.us/forum/loc_ref.php?url=/games/diceescape.phtml -> "http://www.neopets.com/games/diceescape.phtml"

And CGing only works if the script is on the same server as the cookies. loc_ref.php can only ever have access to Neocodex cookies (the script CGing would have to be on neopets.com, and that just isn't happening unless they're retarded).

So anyways, we should have announced the change but then it would be in the news and Neopets would probably realize that we're masking hits from here to there, lol.

Another example of SL's awewsomeness.

[avenger]

Uhm guys...its probably just a cronjob file they use to update premium. I know php since I had a petsite, and its common on petsites to have cron jobs. Theres probably a premium name in the database and theres probably two values for it. 0 and 1. They could easily use this. IF premium equals 1 then this should happen every month. Blah blah. Not really a big deal. Besides...if it was a cookie grabber then innocent people could come across it and get frozen. I know Neo is harsh, but I don't think it was a trap. Php files don't have to show any html. They could use dummy html to throw people off. I'm not sure about phtml...it is the same as PHP isnt it? If so, I've never used it.

[travis]

rofl
oooh i am teh scamzorzzzz
You caught me. I hacked neopets, then put a cookie grabber in it. Since I'm in the database with everyones password showing, it's not useless to put a cookie grabber up.
/sarcasm

/yoursarcasm?
Now can we get back to figuring this out? And btw, those who have no barking idea what they're talking about (aka omg teh cookiez stealer boii), please leave us alone.

Eat me. that was really un necessary.

[Black Flame]

Eat me. that was really un necessary.

I'm siding with Travis. That was uncalled for.